Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 3dgs Method Compare Compare 3D Gaussian Splatting variants across 10+ dimensions. Built-in knowledge of 523+ methods across 24 categories. | |
| 3dgs Paper Reader Read and summarize 3DGS research papers. Extracts method architecture, innovations, experimental results from arXiv or local PDFs. Structured output with tab... | |
| 3dgs Visualizer Generate publication-quality visualizations for 3DGS research: radar charts, comparison tables, method timelines. Static (PDF/PNG) and interactive (HTML) out... | |
| AI Copyright Skill AI-native IP skill: generate patent applications, software copyright materials, or technical disclosures from AI project code/papers/docs, with direct Word a... | |
| Cad Mesh 3dgs Bridge CAD, Mesh, and 3DGS representations. Covers mesh↔3DGS conversion, surface extraction, CAD reverse engineering, B-rep/parametric reconstruction. Analyz... | |
| Cg Paper Writing Academic paper writing for 3D vision, computer graphics, CAD, and 3D understanding. Covers NeRF, 3DGS, SLAM, point cloud, 3D shape, CAD modeling. Supports CV... | |
| Clawhub Publish FDE skill for industrial AI deployment: scenario diagnosis, data governance, solution design, POC-to-scale methodology, ROI quantification. Covers predictive... | |
| Nerf To 3dgs Migrator Migrate NeRF-based methods to 3DGS with step-by-step guidance. Analyzes component compatibility, provides code templates, identifies issues. Covers encoding,... | |
| Patent Software Ip Generate CN patent docs (claims, specification, abstract) and software copyright materials from AI/big-data project code or docs. Covers 7 AI domains + big d... | |
| AI Content Generator Pro AI Content Generator Pro offers multi-model AI content creation for blogs, social media, SEO-optimized marketing, with tone control, scheduling, and integrat... | |
| Content Workflow Engine Automate content creation, management, and distribution workflows. Use when: (1) Creating content pipelines for blogs, social media, or newsletters, (2) Sche... | |
| Financial Analytics Pro Automate financial analysis, integrate with banks and software, generate reports, forecast cash flow, and analyze investments for businesses and professionals. | |
| Meeting Efficiency Pro AI-powered meeting optimization tool that analyzes calendar events, provides efficiency scores, extracts action items, and automates follow-ups. Save 20%+ of... | |
| sales-qualification Evaluates sales opportunities using BANT or MEDDICC methodology. | |
| Bing Wallpaper Use when users need to fetch the daily Bing wallpaper. | |
| Daily Ai News Use when users need comprehensive daily news about AI, large models, and related fields. | |
| Daily News Use when users need daily news summaries, current events, or want to stay informed about world news in Chinese. | |
| Exchange Rate Use when users need to query daily currency exchange rates between two currencies. | |
| Weather Query Use when users ask about weather conditions, forecasts, or climate information for locations in China. | |
| feishu-doc-reviewer 为智能体提供飞书文档读写能力：导出全文、读取评论与段落、写回修改并回复评论。 | |
| Send transactional email via DmartechX/Iemail OpenAPI. Configure in OpenClaw skills env or use secret.md. Send transactional email via Iemail OpenAPI. Configure via OpenClaw skill env only. | |
| 1panel-install 1Panel 服务器管理面板一键安装。当用户提到安装、部署、配置 1Panel 时激活。自动检测是否已安装，已安装则返回访问信息，未安装则自动完成安装流程。 | |
| Concept Anatomy 用 8 个维度（历史/辩证/现象/语言/形式/存在/美感/元反思）解剖任意概念，最终浓缩为一句核心顿悟。 触发词：「解剖概念」「学概念」「搞懂」「学懂」「concept-anatomy」 | |
| Essence Trace 对观点或现象纵向深钻至不可拆分的本质。5 Whys + 第一性原理融合。 触发词：「追本质」「溯源」「为什么」「第一性原理」「essence-trace」 | |
| Iceberg Excavation 从情绪入口出发，分层挖掘潜意识需求、思维模式及底层操作系统，提供深度情绪分析与系统重构建议。 | |
| OpenClaw 心跳设计器 根据你的巡逻需求推荐心跳场景，解释适合原因，生成可用HEARTBEAT.md和对应Cron定时配置。 | |
| OpenClaw 技能组合器 多技能联动编排器，将多个独立Skill串联成"超级技能"自动执行 | |
| OpenClaw 三本说明书生成器 通过对话引导帮助用户确定AI搭档需求，生成个性化的SOUL.md、USER.md和AGENTS.md三本说明书。 | |
| Paper Decompose 把研报/论文的"读后感"提升到"博导审稿视角"——四层结构化提取（缺口/增量/Napkin/启发）。 触发词：「拆论文」「论文四层」「深度解读论文」「研报拆解」「paper-decompose」 | |
| Workspace Bootstrap 快速一键生成符合最佳实践的 OpenClaw workspace 目录结构和核心文件模板，支持多种配置示例和坑点检查。 | |
| Google Drive Access Google Drive from OpenClaw using either GOOGLE_SERVICE_ACCOUNT_KEY service-account JSON or a GOOGLE_OAUTH_REFRESH_TOKEN from the Google Drive OAuth co... | |
| Bigyou 比优 —— 选项比较与决策工具。 当用户面对多个选项不知道如何抉择时激活，包括：选offer、选方案、选工具、选路径、选策略等任何需要做比较和决策的场景。 激活词：帮我选、哪个好、比一比、怎么选、纠结、选哪个、几个选项、选哪个好、A还是B、好难选 核心方法：先跳出选项构建目标画像（底线否决 + 加分项量化打分），... | |
| Feishu Sheet Reader Extract and return data or metadata from Feishu Sheets by parsing sheet links, reading specific ranges, entire sheets, or listing sheet tabs. | |
| Four Angle Analysis 四角度结构化分析框架。当用户需要"刻画对象"、分析一个问题、一个行业、一个系统或任意对象时激活。适用场景：研究一个问题、研究一个行业、写分析报告、系统性拆解万事万物。 | |
| Functional Analysis Optimizer 功能分析法优化器。当用户提到"优化"、"功能分析"、"FAST图"、"拆解问题"、"拆解一切问题"时激活。适用场景：优化某个产品、流程、系统或任意对象（如外卖保温袋、周报流程、App功能、网页设计），要求按功能拆解的方式找到改进路径。 | |
| System Nine Elements 系统九要素 — 将任意对象视作系统来解构的九维度框架。 当用户需要：把某事物当系统拆解、研究一个系统的内部机理、系统性解构一个问题、设计一个系统、写深度分析报告时激活。 激活词：九要素、系统拆解、像系统一样分析、把它拆解成系统、把X当作系统 | |
| Kimi Code API One-click setup to use Kimi K2.5 (Kimi Code) as your coding model in OpenClaw and Claude Code CLI. Kimi Code is Anthropic Messages API compatible — swap the... | |
| KimiClaw KimiClaw: Power your OpenClaw with Kimi K2.5 — the free, Anthropic-compatible coding model. One config change to run Claude Code, spawn coding agents, or cha... | |
| KimiClaw Bridge KimiClaw Bridge: Connect OpenClaw to Kimi K2.5 — the free, Anthropic-compatible coding model. One config change to run Claude Code, spawn coding agents, or c... | |
| Meeting Summary 会议录音 → 结构化纪要。支持 Step ASR 转写、pyannote 说话人分割、声纹实名匹配、LLM 纪要生成，以及长录音 chunk 化增量处理。 | |
| Token Optimization Reduce OpenClaw per-turn prompt costs by 70%+ through file splitting, prompt caching, context pruning, and model routing. Tested on production setup with 69... | |
| User Growth Coach 三层反馈复盘系统 + 随手记，连接当前输入、历史复盘和日常上下文，自动识别深层行为模式。 | |
| 短视频爆款拆解（叙事式） 把一段抖音/小红书短视频拆成「故事 + 心理学」式爆款拆解报告——选题/一句话总结/内容描述/视频结构(开头-中间-结尾)/事件推进/落幕文案/受众启示/核心爆点/节奏/BGM。给运营拍同款、写脚本、做分镜时直接当弹药。当用户说"拆解视频""分析这条视频""帮我看这段抖音""短视频结构""卡点在哪""这条爆款怎么... | |
| 职得Offer校园求职助手 提供校园招聘岗位和面试经验查询，支持职位搜索、详情查看及面试复盘信息检索。 | |
| Jenkins Executor Skill Jenkins 任务全生命周期管理工具，支持任务列表获取、远程构建、构建状态实时查询、构建日志全文获取、运行中构建强制终止，适用于 CI/CD 自动化、发布流水线、运维自动化场景。 | |
| Analysis Run deep system health checks across workspace, config, skills, and integrations with prioritized findings and remediation. | |
| Copywriting Write persuasive copy for landing pages, emails, ads, sales pages, and marketing materials. Use when you need to write headlines, CTAs, product descriptions,... | |
| Truth Check 真相核查与幻觉检测。在生成内容后检测并纠正可能的幻觉、编造或不准确信息。 触发条件：(1) 生成技术内容后 (2) 提供统计数据时 (3) 引用人物/事件时 (4) 生成代码示例后 | |
| Uncertainty Verification 事实核查与幻觉检测。在生成内容后检测并纠正可能的幻觉、编造或不准确信息。 触发条件：(1) 生成技术内容后 (2) 提供统计数据时 (3) 引用人物/事件时 (4) 生成代码示例后 | |
| Validate Agent Agent验证与质量保证。减少静默系统错误，产出可重现的证据。 触发条件：(1) 完成任务时 (2) 修复问题后 (3) 提供答案前 (4) 跨会话承诺时 |
39,951–40,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.